Роутер реализован на FreeBSD 7.1, связка IPFW+IPNAT, две сетевых карты. Есть две подсети: локалка - 192.168.15.0/24 на rl0 и внешняя подсеть, скажем, 195.64.216.16/29 тоже на rl0 с маршрутизацией у провайдера. На внутреннем интерфейсе установлен алиас для подсети из внешних адресов. Привожу результат ifconfig.
Код: Выделить всё
# ifconfig
vr0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1472
options=2808<VLAN_MTU,WOL_UCAST,WOL_MAGIC>
ether 00:05:5d:6b:94:f4
inet 195.64.216.50 netmask 0xfffffff0 broadcast 195.64.216.63
media: Ethernet autoselect (100baseTX <full-duplex>)
status: active
rl0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=8<VLAN_MTU>
ether 00:0f:ea:c3:dc:99
inet 195.64.216.22 netmask 0xfffffff8 broadcast 195.64.216.23
inet 192.168.15.1 netmask 0xffffff00 broadcast 192.168.15.255
media: Ethernet autoselect (100baseTX <full-duplex>)
status: active
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
inet 127.0.0.1 netmask 0xff000000Код: Выделить всё
# cat /etc/rc.conf
defaultrouter="195.64.216.62"
ifconfig_vr0="inet 195.64.216.50 netmask 255.255.255.240"
ifconfig_rl0="inet 192.168.15.1 netmask 255.255.255.0"
ifconfig_rl0_alias0="inet 195.64.216.22 netmask 255.255.255.248"
gateway_enable="YES"
router_enable="NO"
sshd_enable="YES"
named_enable="YES"
ipnat_enable="YES"
ipnat_program="/sbin/ipnat -CF"
ipnat_rules="/etc/ipfw/ipnat"Код: Выделить всё
00100 check-state
00110 allow ip from any to any via lo0
00120 deny log ip from any to 127.0.0.0/8
00130 deny log ip from 127.0.0.0/8 to any
00140 deny log ip from any to 10.0.0.0/8 in via vr0
00150 deny log ip from any to 172.16.0.0/12 in via vr0
00160 deny log ip from any to 192.168.0.0/16 in via vr0
00170 deny log ip from any to 0.0.0.0/8 in via vr0
00180 deny log ip from any to 169.254.0.0/16 in via vr0
00190 deny log ip from any to 224.0.0.0/4 in via vr0
00200 deny log ip from any to 240.0.0.0/4 in via vr0
00210 deny log icmp from any to any frag
00220 deny log icmp from any to 255.255.255.255 in via vr0
00230 deny log icmp from any to 255.255.255.255 out via vr0
00240 deny log ip from 10.0.0.0/8 to any out via vr0
00250 deny log ip from 172.16.0.0/12 to any out via vr0
00260 deny log ip from 192.168.0.0/16 to any out via vr0
00270 deny log ip from 0.0.0.0/8 to any out via vr0
00280 deny log ip from 169.254.0.0/16 to any out via vr0
00290 deny log ip from 224.0.0.0/4 to any out via vr0
00300 deny log ip from 240.0.0.0/4 to any out via vr0
00310 allow ip from 192.168.15.0/24 to 195.64.216.16/29 via rl0
00320 allow ip from 195.64.216.16/29 to 192.168.15.0/24 via rl0
00330 fwd 127.0.0.1,3128 tcp from 192.168.15.0/24 to not me dst-port 80 in recv rl0
00340 fwd 127.0.0.1,3128 tcp from 192.168.15.0/24 to not me dst-port 80 in recv ng*
55080 allow ip from any to 195.64.216.17 dst-port 55777 in via vr0
55090 allow ip from 195.64.216.17 55777 to any out via vr0
55100 allow icmp from any to any icmptypes 0,3,4,8,10,11,30
55110 allow tcp from any to any established
55120 allow ip from 195.64.216.50 to any via vr0
55130 allow udp from any 53 to any via vr0
55140 allow ip from any to 195.64.216.50 dst-port 53 via vr0
55150 allow udp from any 123 to any via vr0
55160 allow tcp from any to 195.64.216.50 dst-port 21 via vr0
55170 allow tcp from any to 195.64.216.50 dst-port 20 via vr0
55180 allow tcp from any to 195.64.216.50 dst-port 42915-65535 via vr0
55190 allow tcp from any to 195.64.216.50 dst-port 5901 via vr0
55200 allow tcp from any to 195.64.216.50 dst-port 3389,33389 via vr0
55210 allow tcp from any to 195.64.216.50 dst-port 25 in via vr0 setup
55220 allow tcp from any to 195.64.216.50 dst-port 110 in via vr0
55230 allow tcp from any to 195.64.216.50 dst-port 143 via vr0
55240 allow udp from any 161 to 195.64.216.50 via vr0
55250 allow tcp from any to 195.64.216.50 dst-port 3306 in via vr0
55260 allow tcp from 192.168.15.0/24 to any dst-port 5190 in via rl0 setup
55270 allow ip from any 87 to 195.64.216.50 via vr0
55280 allow tcp from any to 195.64.216.16/29 dst-port 80,443 in via vr0
55290 allow tcp from 195.64.216.16/29 to any out via vr0
55300 allow tcp from any to 195.64.216.50 dst-port 1723 in via vr0
55310 allow tcp from 195.64.216.50 1723 to any out via vr0
55320 allow gre from any to any
55330 allow ip from any to any via rl0
55340 allow ip from any to any via ng*
55350 deny log ip from any to any
65535 deny ip from any to anyКод: Выделить всё
# NAT
map vr0 from 192.168.15.0/24 to any -> 195.64.216.50/32 proxy port ftp ftp/tcp
map vr0 from 192.168.15.0/24 to any -> 195.64.216.50/32 portmap tcp/udp 1025:65535
map vr0 from 192.168.15.0/24 to any -> 195.64.216.50/32
# Redirect Mail
rdr vr0 195.64.216.50 port 25 -> 192.168.15.100 port 25 tcp
rdr vr0 195.64.216.50 port 110 -> 192.168.15.100 port 110 tcp
# Redirect MySQL
rdr vr0 195.64.216.50 port 3306 -> 195.64.216.18 port 3306 tcp
# Redirect Passive FTP to 100
rdr vr0 195.64.216.50 port 20 -> 192.168.15.100 port 20 tcp
rdr vr0 195.64.216.50 port 21 -> 192.168.15.100 port 21 tcp
rdr vr0 195.64.216.50 port 65530 -> 192.168.15.100 port 65530 tcp
rdr vr0 195.64.216.50 port 65531 -> 192.168.15.100 port 65531 tcp
rdr vr0 195.64.216.50 port 65532 -> 192.168.15.100 port 65532 tcp
rdr vr0 195.64.216.50 port 65533 -> 192.168.15.100 port 65533 tcp
rdr vr0 195.64.216.50 port 65534 -> 192.168.15.100 port 65534 tcp
rdr vr0 195.64.216.50 port 65535 -> 192.168.15.100 port 65535 tcp
# Redirect VNC to 100
rdr vr0 195.64.216.50 port 5901 -> 192.168.15.100 port 5901 tcp
# Redirect RDP to 100
rdr vr0 195.64.216.50 port 3389 -> 192.168.15.100 port 3389 tcp
# Redirect RDP to 1C
rdr vr0 195.64.216.50 port 33389 -> 192.168.15.8 port 3389 tcpПроблема в том, что при обращении с внехи на FTP всё прекрасно работает. А с подсети 195.64.216.16/29 пакеты на внешний интерфейс 195.64.216.50 не проходят.
При обращении из подсети 195.64.216.16/29 на локальный IP адрес 192.168.15.100 соединение виснет при переходе в пассивный режим, естественно.
Уже неделю ломаю голову над этим. Решил обратиться к свежему взгляду, может что-то упускаю?
